TROJ_REMDOBE.UJK

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It is injected into all running processes to remain memory resident.

However, as of this writing, the said sites are inaccessible. It deletes the initially executed copy of itself.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %Application Data%\AlienWare\vAlien.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It creates the following folders:

• %Application Data%\AlienWare

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It is injected into all running processes to remain memory resident.

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• {random characters}

Other Details

This Trojan attempts to access the following websites to download files, which are possibly malicious:

• http://dl.{BLOCKED}x.com/FileToDownload.exe
• http://{BLOCKED}nzo.pw/1370687939_0.80426800.exe
• http://{BLOCKED}olumers.info/1370732239_0.51267400.exe

However, as of this writing, the said sites are inaccessible.

It deletes the initially executed copy of itself